Blockchain analytics company Chainalysis traced a long-running network of Russian intermediaries who helped North Korean IT workers convert millions of dollars in cryptocurrency into cash through the Garantex exchange. According to Cointelegraph, the network’s activity was detailed in a Wednesday report that described how funds moved from North Korean-linked wallets to Russian intermediaries. The US Treasury Department’s Office of Foreign Assets Control (OFAC) announced on Wednesday that it had sanctioned 10 individuals and one entity for supporting North Korean government-run IT worker schemes. Treasury said the schemes generated funds for the country’s weapons programs. The sanctioned individuals included Russian nationals Ilya Aleksandrovich Boykov and Vitold Viktorovich Obertas, whom Treasury linked to cryptocurrency conversions for North Korean entities and officials.

Treasury said Boykov had converted about $3.5 million in cryptocurrency for sanctioned company Alis since 2024. Obertas, meanwhile, had handled nearly $2 million in crypto conversions for North Korean officials since January 2025. Chainalysis described one transaction in which a wallet linked to a North Korean IT worker received recurring stablecoin payments, converted them into Ether (ETH), and moved the funds through consolidation addresses to Boykov. He then sent the cryptocurrency to Garantex to cash out. North Korean IT workers who use false identities to secure jobs at crypto companies have remained a security concern. In June 2025, the US Department of Justice announced charges against four North Korean nationals over a scheme involving fraudulent IT employment and the theft of more than $900,000 from US and Serbian crypto companies.